1. Technical Field
The present invention relates to a method and system for data processing in general, and in particular to a method and system for providing system security on a computer. Still more particularly, the present invention relates to a method for providing security to a computer on a computer network such that remote configuration of the computer can be allowed.
2. Description of the Prior Art
Generally speaking, personal computers can be connected together to form computer networks in many ways and through the use of various schemes. In some computer networks, personal computers are used essentially as xe2x80x9cdumbxe2x80x9d terminals to communicate with a more powerful host computer XO typically known as a mainframe that serves to provide large databases and as the location of residence of applications programs. In other computer networks, personal computers are used as xe2x80x9csmartxe2x80x9d terminals that obtain application programs and sometimes data from a central file server (which may be another personal computer equipped with a direct access storage device of large capacity and capable of operating at relatively quick data recovery speeds), manipulate or receive entry of data, and return data to the file server. In still other computer networks, a group of personal computers may share among group resources, including peripheral devices such as printers, scanners, modems, etc., available to one or more of the personal computers within the computer network, and application program or data files located on various direct access storage devices each of which is more directly associated with a single one of the resource sharing personal computers. This type of computer network arrangements are typically known as a local-area network (LAN).
Although computer networks allow software updates and asset management to be performed in a more efficient manner, one area that has not benefitted from the computer networks is configuration management. Part of the problem preventing remote configuration updates to individual computers within a computer network is the fact that some updates require physical actions. These updates include adding an adapter card to an I/O channel or installing additional memories to a local memory bus. However, other configuration actions, such as changing DMA channel usage, assigning I/O address spaces, or assigning interrupt levels, could be performed at a remote network management point. The only problem is that the security of the computer network may be compromised if the configuration of a personal computer within the computer network is allowed to be changed remotely without any restriction. The present disclosure provides a method for ensuring network security before any remote configuration on a personal computer within a computer network is allowed.
The present invention provides security to a computer on a computer network for allowing remote configuration of the computer. In accordance with a preferred embodiment of the present invention, when a network-supplied privileged-access password (PAP) is encountered during a system boot-up operation of the computer, the network-supplied PAP is compared with a system-installed PAP. The network-supplied PAP is stored in a first location of a non-volatile memory of the computer, and the system-installed PAP is stored in a second location of the non-volatile memory of the computer. The system-installed PAP is previously entered to the computer via a keyboard of the computer. If the network-supplied PAP does not match the system-installed PAP, a tamper evident mechanism within the computer is set. Otherwise, if the network-supplied PAP matches the system-installed PAP, the boot-up operation continues to be performed. After the boot-up operation has been completed, configuration of the computer is allowed to be performed remotely over the computer network.
All objects, features, and advantages of the present invention will become apparent in the following detailed written description.